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Abstract — [] Secrecy capacity of a multiple-antenna wiretap chan- 
nel is studied in the low signal-to-noise ratio (SNR) regime. Expres- 
sions for the first and second derivatives of the secrecy capacity 
with respect to SNR at SNR = are derived. Transmission strategies 
required to achieve these derivatives are identified. In particular, it 
is shown that it is optimal in the low-SNR regime to transmit in 
the maximum-eigenvalue eigenspace of * = Hj„H m — -^p-HjH e 
where H m and H,, denote the channel matrices associated with the 
legitimate receiver and eavesdropper, respectively, and N m and N e 
are the noise variances at the receiver and eavesdropper, respectively. 
Energy efficiency is analyzed by finding the minimum bit energy 
required for secure and reliable communications, and the wideband 
slope. Increased bit energy requirements under secrecy constraints 
are quantified. Finally, the impact of fading is investigated. 

I. Introduction 

Secure transmission of confidential messages is a critical issue 
in communication systems and especially in wireless systems 
due to the broadcast nature of wireless transmissions. In [1], 
Wyner addressed the transmission security from an information- 
theoretic point of view, and identified the rate-equivocation region 
and established the secrecy capacity of the discrete memoryless 
wiretap channel in which the wiretapper receives a degraded 
version of the signal observed by the legitimate receiver. The 
secrecy capacity is defined as the maximum communication rate 
■from the transmitter to the legitimate receiver, which can be 
achieved while keeping the eavesdropper completely ignorant of 
the transmitted messages. Later, these results are extended to 
Gaussian wiretap channel in [2]. In [3], Csiszaf and Korner con- 
sidered a more general wiretap channel model and established the 
secrecy capacity when the transmitter has a common message for 
two receivers and a confidential message to only one. Recently, 
there has been a flurry of activity in the area of information- 
theoretic security, where, for instance, the impact of fading, 
cooperation, and interference on secrecy are studied (see e.g., 
[4] and the articles and references therein). Several recent results 
also addressed the secrecy capacity when multiple-antennas are 
employed by the transmitter, receiver, and the eavedropper [5]- 
[9]. The secrecy capacity for the most general case in which 
arbitrary number of antennas are present at each terminal has 
been established in [8] and [9]. 

In addition to security issues, another pivotal concern in most 
wireless systems is energy-efficient operation especially when 
wireless units are powered by batteries. From an information- 
theoretic perspective, energy efficiency can be measured by the 
energy required to send one information bit reliably. It is well- 
known that for unfaded and fading Gaussian channels subject 
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to average input power constraints, energy efficiency improves 
as one operates at lower SNR levels, and the minimum bit 
energy is achieved as SNR vanishes [11]. Hence, requirements 
on energy efficiency necessitate operation in the low-SNR regime. 
Additionally, operating at low SNR levels has its benefits in terms 
of limiting the interference in wireless systems. 

In this paper, in order to address the two critical issues 
of security and energy-efficiency jointly, we study the secrecy 
capacity in the low-SNR regime. We consider a general multiple- 
input and multiple-output (MIMO) channel model and identify 
the optimal transmission strategies in this regime under secrecy 
constraints. Since secrecy capacity is in general smaller than 
the capacity attained in the absence of confidentiality concerns, 
energy per bit requirements increase due to secrecy constraints. In 
this work, we quantify these increased energy costs and address 
the energy-secrecy tradeoff. 

II. Channel Model 

We consider a MIMO channel model and assume that the 
transmitter, legitimate receiver, and eavesdropper are equipped 
with nT,nn, and tie antennas, respectively. We further assume 
that the channel input-output relations between the transmitter 
and legitimate receiver, and the transmitter and eavesdropper are 
given by 



and y e = H e x 



(1) 



respectively. Above, x denotes the tit X 1-dimensional transmit- 
ted signal vector. This channel input is subject to the following 
average power constraint: 

E{||x|| 2 } = tr(K :c ) <P (2) 

where tr denotes the trace operation and K x = E{xx^} is 
the covariance matrix of the input. In ([T), tir x 1-dimensional 
y m and tie x 1-dimensional y e represent the received signal 
vectors at the legitimate receiver and eavesdropper, respectively. 
Moreover, n m with dimension tir x 1 and n e with dimension 
rifiXl are independent, zero-mean Gaussian random vectors with 
E{n m ri! m } = iV TO I and E{n e n\} = N e I, where I is the identity 
matrix. The signal-to-noise ratio is defined as 

E{||x|| 2 } P 



SNR 



El 



(3) 



.II 2 } n R N m 

Finally, in the channel models, H m is the x n^-dimensional 
channel matrix between the transmitter and legitimate receiver, 
and H e is the ue x n^-dimensional channel matrix between 
the transmitter and eavesdropper. While being fixed deterministic 



matrices in unfaded channels, H m and H e in fading channels 
are random matrices whose components denote the fading coef- 
ficients between the corresponding antennas at the transmitting 
and receiving ends. 

III. Secrecy in the Low-SNR Regime 

Recently, in [8] and [9], it has been shown that when the 
channel matrices H m and H e are fixed for the entire transmission 
period and are known to all three terminals, then the secrecy 
capacity in nats per dimension is given bj@ 



tive of the secrecy capacity at SNR = is given by 



C s = — max logdet [I + ——H m K x H 



logdet ( I + — H e K x HJ 



(4) 



where the maximization is over all possible input covariance 
matrices K. x y_ C0 subject to a trace constraint. We note that 
since logdet (I + l/iVmHmKaH^) is a concave function of 
Kj, the objective function in is in general neither concave 
nor convex in K^, making the identification the optimal input 
covariance matrix a difficult task. 

In this paper, we concentrate on the low-SNR regime. In this 
regime, the behavior of the secrecy capacity can be accurately 
predicted by its first and second derivatives with respect to SNR 
at SNR = 0: 



C s (snr) = C7 s (0)snr 



(7.(0) 2 

——SNR 



o(SNR 2 ). (5) 



Moreover, C s (0) and C s (0) also enable us to analyze the energy 
efficiency in the low-SNR regime through [11] 
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and So = 



<7 S (0) 



(6) 



where ^ L 

iv s.min 



C s (0) -C a (0) 

denotes the minimum bit energy required for 
reliable communication under secrecy constraints, and Sq denotes 
the wideband slope which is the slope of the secrecy capacity in 
bits/dimension/(3 dB) at the point jf- . These quantities pro- 
vide a linear approximation of the secrecy capacity in the low-SNR 
regime. While ^ is a performance measure for vanishing 

No s.min r 

SNR, Sn together with & characterize the performance at 
low but nonzero SNRs. We note that the formula for the minimum 
bit energy is valid if C s is a concave function of SNR, which we 
show later in the paper. 

The following result identifies the first and second derivatives 
of the secrecy capacity at SNR = 0. 

Theorem 1: The first derivative of the secrecy capacity in (01 
with respect to SNR at SNR = is 



<7 S (0) = [A max (*)r 



A max (*) if A max (*) > 
else 



(7) 



where 4> 



JV„ 



H,EH e . Moreover, the second deriva- 



2 Unless stated otherwise, all logarithms throughout the paper are to the base e. 

3 >; and >- denote positive semidefinite and positive definite partial orderings, 
respectively, for Hermitian matrices. If A y B, then A — B is a positive 
semidefinite matrix. Similarly, A >- B implies that A — B is positive definite. 



C s (0) = -n R miri ^ a l a J ^\u]Hl l U m u l \ 2 

a;S[0,l] Vi i '- ?=1 

EU«< =1 

N 2 \ 
-^f|u]HtH e u 4 | 2 Jl{A max (*>0)} (8) 

where I is the multiplicity of A max (^) > 0, {u^} are the 
eigenvectors that span the maximum-eigenvalue eigenspace, and 

l{A max (*) > 0} = | J f ls e max( * } > ° is the indicator 
function. 

Proof: We first note that the input covariance matrix = 
E'jxxt } is by definition a positive semidefinite Hermitian matrix. 
As a Hermitian matrix, T£ x can be written as [13, Theorem 4. 1 .5] 

K x - UAU f (9) 

where U is a unitary matrix and A is a real diagonal matrix. 
Using (0, we can also express Kj as 



K x = ^2 diUiu\ 



(10) 



where {di} are the diagonal components of A, and {u^} are the 
column vectors of U and form an orthonormal set. Assuming 
that the input uses all the available power, we have tr(K x ) = 
S™=i di = P- Noting that K K is positive semidefinite and hence 
di > 0, we can write di — o^P where ai E [0,1] Mi and 
S™=i Q!i = 1. Now, the secrecy rate achieved with a particular 
covariance matrix K x can be expressed as 

I s (SNR) = — [ log det ( I + n R SNR V aiUmU^U^ ) 

nR \ \ t! J 

- log det (I + snr V aiUeUiutnl] ) . 



i=l 



(ID 

where SNR is defined in (O. As also noted in [11], we can easily 

show that d , , , , T ... ... 

■logdst(I + t;A) v= o=tr(A), (12) 



dv 
d 2 

—5 logdet(I + wA)|^ =0 = -tr(A 2 ). 



(13) 



Now, using (fT2l . we obtain the following expression for the first 
derivative of the secrecy rate I s with respect to SNR at SNR = 0: 

" T f N \ 

j.(0) ^a, tr(H mUi uiHtj - -^tr (H e u iU jHt) (14) 



/ = 1 

E 

ThT 



N„ 



aj { ujH^H r „u 4 - ^ujH,!;H e u 4 



(15) 



^aiu] ( H^H m - -^pH^He ) Uj = V ",u! <I>u, 



/ ; »» u r 

8=1 



(16) 

where (fl3T > follows from the property that tr (AB) = tr(BA). 
Also, in ( TTBT l. we have defined # = Hj^Hm - jf-Hl~H. e - Since 
$ is a Hermitian matrix and {u^} are unit vectors, we have [13, 
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Theorem 4.2.2] 



u{*u ; < A max (*) Mi 



(17) 



where A max ($) denotes the maximum eigenvalue of the matrix 
<fr. Recall that oti G [0, 1] and J2i a i = !• Then, from (fTTT i. we 
obtain 

^ut^Ui < A max ($). 



(18) 



Note that this upper bound can be achieved if, for instance, 
ai = 1 and ctfj = Vi ^ 1, and Ui is chosen as the 
eigenvector that corresponds to the maximum eigenvalue of 
Heretofore, we have implicitly assumed that A max (<&) > and 
all the available power is used to transmit the information in 
the direction of the maximum eigenvalue. If A max («I>) < 0, then 
all eigenvalues of <I> are less than or equal to zero, and hence 
$ is a negative semidefinite matrix. In this situation, none of 
the channels of the legitimate receiver is stronger than those 
corresponding ones of the eavesdropper. In such a case, secrecy 
capacity is zero. Therefore, if A max (<I?) < 0, we have C s (0) = 0. 
Finally, we conclude from (fT8l and the above discussion that the 
first derivative of the secrecy capacity with respect to SNR at 
SNR = is given by 



Cs{0) = 



If A n 



A m ax(*) if A max (*) > 







else 



(19) 



c (<&) > is distinct, C s (0) is achieved when we choose 
K. x = Puiuj where Ui is the eigenvector that corresponds 
to A max (€>). Therefore, beamforming in the direction in which 
the eigenvalue of $ is maximized is optimal in the sense of 
achieving the first derivative of the secrecy capacity in the low- 
SNR regime. More generally, if A max ($) > has a multiplicity, 
any covariance matrix in the following form achieves the first 
derivative: 



K x = P^ttiUiuj 



(20) 



where I is the multiplicity of the maximum eigenvalue, 
{Uj}' =1 are the eigenvectors that span the maximum-eigenvalue 
eigenspace, and are constants, taking values in [0, 1] 

and having the sum ]Ci=i a i = 1- Therefore, transmission in the 
maximum-eigenvalue eigenspace is necessary to achieve C s (0). 

Next, we consider the second derivative of the secrecy capacity. 
Again, when A max ($) < 0, the secrecy capacity is zero and 
therefore C s (0) — 0. Hence, in the following, we consider the 
case in which A max (<&) > 0. Suppose that the input covariance 
matrix is chosen as in d20l > with a particular set of {ai}. Then, 
using ( TOI l. we can obtain 



1.(0) = 




(21) 



-nR^ctiCtj I |u]H^H m u. 



N 2 

1 Y m 



12 IVm |utHlH P u |2 



where (1221 is obtained by using the fact that tr (AB) = tr (BA) 
and performing some straightforward manipulations. Note again 
that {u;} are the eigenvectors spanning the maximum-eigenvalue 
eigenspace of <I>. Being necessary to achieve the first derivative, 
the covariance structure given in ( 1201 is also necessary to achieve 
the second derivative. Therefore, the second derivative of the 
secrecy capacity at SNR = is the maximum of the expression 
in d22l over all possible values of {on}. Hence, 



C s (0) = — nji min > enjoy 
{ai} ' 
aiG[0,l]Vi % ' 3 



N 2 

jujH^u^-^lutHtHeU, 



(23) 



(22) 



Since C s (0) is equal to the expression in (1231 when A max ($) > 
and is zero otherwise, the final expression in ([H) is obtained 
by multiplying the formula in d23l with the indicator function 
l{A max ($) > 0}. ■ 

Remark 1: In the absence of secrecy constraints, the first and 
second derivatives of the MIMO capacity at SNR = are [11] 

C(0) = A max (Ht,H m ) and (3(0) = X 2 max (Ul n H m ) (24) 

where I is the multiplicity of A max (Hj„H„ l ). Hence, the first and 
second derivatives are achieved by transmitting in the maximum- 
eigenvalue eigenspace of H| n H TO , the subspace in which the 
transmitter-receiver channel is the strongest. Due to the optimality 
of the water-filling power allocation method, power should be 
equally distributed in each orthogonal direction in this subspace 
in order for the second derivative to be achieved. 

Remark 2: We see from Theorem Q] that when there are se- 
crecy constraints, we should at low SNRs transmit in the direction 
in which the transmitter-receiver channel is strongest with respect 
to the transmitter-eavesdropper channel normalized by the ratio 
of the noise variances. For instance, C s (0) can be achieved by 
beamforming in the direction in which the eigenvalue of $ is 
maximized. On the other hand, if A max (<&) has a multiplicity, 
the optimization problem in dH) should be solved to identify how 
the power should be allocated to different orthogonal directions in 
the maximum-eigenvalue eigenspace so that the second-derivative 
C s (0) is attained. In general, the optimal power allocation 
strategy is neither water- filling nor beamforming. For instance, 
consider parallel Gaussian channels for both transmitter-receiver 
and transmitter-eavesdropper links, and assume that Hj Tl H„, = 
diag(5,4, 2) and HjH e = diag(2,l,l) where diag() is used to 
denote a diagonal matrix with components provided in between 
the parentheses. Assume further that the noise variances are 
equal, i.e., N m — N e . Then, it can be easily seen that A max ($) 
,'i and has a multiplicity of 2. Solving the optimization problem in 
(O provides oti = 5/12 and = 7/12. Hence, approximately, 
42% of the power is allocated to the channel for which the 
transmitter-receiver link has a strength of 5, and 58% is allocated 
for the channel with strength 4. 

Remark 3: When A max (<fr) > is distinct, then beamforming 
in the direction in which A(<fr) is maximized is optimal in the 
sense of achieving both C s (0) and C s (0). Moreover, in this case, 
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we have 



C s (0) = -n R ||H mUl 



N 2 

1 y m 

N 2 



|H eUl || 4 



(25) 



where Ui is the eigenvector that corresponds to A max (*I>). 

Remark 4: From [13, Theorem 4.3.1], we know that for two 
Hermitian matrices A and B with the same dimensions, we have 



A max (A + B) < A n 



c (A) + A max (B). 



Applying this result to our setting yields 



Amax(#) < A„ 



<( H m H m) ~ ^min ( -^-H ( IH< 



N„ 



(26) 



(27) 



Therefore, we conclude from Remark Q] that secrecy constraints 
diminish the first derivative C s (0) at least by a factor of 
•\nin ^T^HtH,^ when compared to the case in which there 
are no such constraints. 

Remark 5: In the case in which each terminal has a single 
antenna, the results of Theorem [T] specialize to 

-i + 



C.(0) 



C s (0) 



Nrn 

N K 



N 2 
N 2 



i + 



(28) 



(29) 



In the next result, we show that the secrecy capacity is concave 
in SNR. 

Proposition 1: The secrecy capacity C s achieved under the 
average power constraint E{||x|| 2 } < P is a concave function of 
SNR. 

Proof: Concavity can be easily shown using the time-sharing 
argument. Assume that at power level Pi and signal-to-noise ratio 
SNRi, the optimal input is Xi, which satisfies E{||xi|| 2 } < Pi, 
and the secrecy capacity is C s (SNRi). Similarly, for P2 and 
SNR2, the optimal input is X2, which satisfies E{||x2|| 2 } < P2, 
and the secrecy capacity is C S (SNR2). Now, we assume that the 
transmitter performs time-sharing by transmitting at two different 
power levels using X! and x 2 . More specifically, in fraction of 
the time, the transmitter uses the input x x , transmits at most 
at Pi, and achieves the secrecy rate C s (SNRi). In the remaining 
(1 — 0) fraction of the time, the transmitter employs X2, transmits 
at most at P%, and achieves the secrecy rate C S (SNR2). Hence, 
this scheme overall achieves the average secrecy rate of 



(30) 

I 2 } < 



6»C , s (SNRi) + (l-6l)C , ;i (SNR2) 

by transmitting at the level 0E{||xi|| 2 } + (1 - 0)E{||x 2 
Pg = 6Pi + (l — 6)P2- The average signal-to-noise ratio is SNRg = 
6>SNRi + (1 - 0)snr 2 . Therefore, the secrecy rate in d30l > is an 
achievable secrecy rate at SNRg. Since the secrecy capacity is the 
maximum achievable secrecy rate, the secrecy capacity at SNRg 
is larger than that in d30l l. i.e., 

(31) 
(32) 



C s (SNRg) = C s (0SNRi + (1 - 0)SNR 2 ) 

>0C s (SN Rl ) + (l-0)C s (SNR 2 ), 



showing the concavity. ■ 
We further note that the concavity can also be shown using 
the following facts. As also discussed in [10], MIMO secrecy 
capacity is obtained by proving in the converse argument that 



the considered upper bound is tight and 

C s = max min 7(x;y r |y e ) (33) 

where T> is the set of joint conditional density functions 

p(yUy' e \ x ) that satisf y p(y'r\ x ) = p(yr|x) and p(y' e |x) = 

p(y e |x). Note that for fixed channel distributions, the mutual in- 
formation /(x; y r |y e ) is a concave function of the input distribu- 
tion p(x). Since the pointwise infimum of a set of concave func- 
tions is concave [14], /(p(x)) = min p(j / yj x)eV /(x; y' r \y' e ) 
is also a concave function of p(x). Concavity of the functional 
/ and the fact that maximization is over input distributions 
satisfying E{||x|| 2 } < P lead to the concavity of the secrecy 
capacity with respect to SNR. 

We can now write the following corollary to Proposition Q] and 
Theorem Q] 

Corollary 1: The minimum bit energy attained under secrecy 
constraints is 

E b log 2 



No 

s.min [A max (*)]+' 

Remark 6: From Remark [4] we can write 



(34) 



Nn 



log 2 



[^max(^) 



> 



log 2 



> 



log 2 

A m ax ( H m H m ) 



An 



Eb_ 

No min 



(^HlH e ) 
(35) 



where in d35l l denotes the minimum bit energy in the 

«o min aJ 

absence of secrecy constraints. Hence, in general, secrecy re- 
quirements increase the energy expenditure. When secure com- 
munication is not possible, fA max (3?)l + = and Mr- =00. 

L v /J Jv s,min 

The expression for the wideband slope So can be readily 
obtained by plugging in the expressions in (0 and ^ into that 
in ©. 

Remark 7: Energy costs of secrecy can easily be identified in 
the single-antenna case. Clearly, the minimum bit energy in the 
presence of secrecy is strictly greater than that in the absence of 
such constraints: 

Eb = log2 _ log2 E b 

Nn ■ ~ 
1 Y U s,mm 



\h |2_JY HL |7 



> 



N 



(36) 



min 



1 2 > 0. Furthermore, the energy requirement in- 
creases monotonically as the value of -^p|/i e | 2 increases. Indeed, 
\he\ 2 = \h m \ 2 , secure communication is not possible 
= 00. 



when -jf-\h e 



when jP 



and §l 

"0 s.mm 



IV. The Impact of Fading 



In this section, we assume that the channel matrices H m and 
H e are random matrices whose components are ergodic random 
variables, modeling fading in wireless transmissions. We again 
assume that realizations of these matrices are perfectly known 
by all the terminals. As discussed in [12], fading channel can 
be regarded as a set of parallel subchannels each of which 
corresponds to a particular fading realization. Hence, in each 
subchannel, the channel matrices are fixed similarly as in the 
channel model considered in the previous section. In [12], Liang 
et al. have shown that having independent inputs for each 
subchannel is optimal and the secrecy capacity of the set of 
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parallel subchannels is equal to the sum of the capacities of 
subchannels. Therefore, the secrecy capacity of fading channels 
can be be found by averaging the secrecy capacities attained for 
different fading realizations. 

We assume that the transmitter is subject to a short-term power 
constraint. Hence, for each channel realization, the same amount 
of power is used and we have tr (K x ) < P. With this assumption, 
the transmitter is allowed to perform power adaptation in space 
across the antennas, but not across time. Under such constraints, 
it can easily be seen from the above discussion that the average 
secrecy capacity in fading channels is given by 



C s =— Eh h, < max logdet ( I + — H m K x Bl 

tr(K x )<P 



logdet I I 



1 



H r K r Ht 



(37) 



where the expectation is with respect to the joint distribution of 
(H m ,H e ). Note that the only difference between (|4|i and (f37T > 
is the presence of expectation in (f3Tb . Due to this similarity, the 
following result can be obtained immediately as a corollary to 
Theorem [T] 

Corollary 2: The first derivative of the average secrecy capac- 
ity in (l37l i with respect to SNR at SNR = is 



Cs(P) =E Hm ,H E {[A max (*)] + } 



(38) 



where again <& = H| n H m — ^p-H£H e . The second derivative 
of the average secrecy capacity at SNR = is given by 

C s (0) = -n_RE Hm ,H e j mm ajOtj MutH^H ro u^| 2 

- ^-|u]HtH eUl | 2 ^l{A max (*) > 0}| (39) 

where 1{-} again denotes the indicator function, I is the multi- 
plicity of A max ($) > 0, and {u;} are the eigenvectors that span 
the maximum-eigenvalue eigenspace for particular realizations of 
H m and H e . 

Remark 8: Similarly as in the unfaded case, C s (0) is achieved 
by always transmitting in the maximum-eigenvalue eigenspace of 
the realizations of the channel matrices H TO and H e . In order 
to achieve the second derivative, optimal values of {c^} (or 
equivalently the optimal power allocation across the antennas) 
should be identified again for each possible realization of the 
channel matrices. 

Remark 9: In the single-antenna case in which tit = tir . = 
Ue = 1) the first and second derivatives of the average secrecy 
capacity become 



6.(0) =E 



h m ,h. 



C s (Q)=E hm , h 




N 
N 



1 + 



-i + 



(40) 



(41) 



channels under secrecy constraints is 

Eb log 2 



(42) 



s.min -H m ,H e {[Amax(*)] + } 

Remark 10: Fading has a potential to improve the low-SNR 
performance and hence the energy efficiency. To illustrate this, 
we consider the following example. Consider first the unfaded 
Gaussian channel in which the deterministic channel coefficients 
are h m = h e = 1. For this case, we have 



0,(0) 



1 



and 



log 2 



s.min 



i 



A',„ 

Ne 



(43) 



Now, consider a Rayleigh fading environment and assume that 
h m and h e are independent, zero-mean, Gaussian random vari- 
ables with variances S{|/i m | 2 } = £?{|/i e | 2 } = 1. Then, we can 
easily find that 



C s (0) =E hm ,fc e 



leading to J| 



\h, 



Nm 

N K 



N, 



N„ 



log 2 



Note that if N e > 0, 



N K 



N„ 



N m +Ne 



(44) 



> 



1 



JV„, 

Ne 



Corollary 3: The minimum bit energy achieved in fading 



Hence, fading strictly improves the low-SNR per- 
formance by increasing C s (0) and decreasing the minimum bit 
energy even without performing power control over time. Further 
gains are possible with power adaptation. Another interesting 
observation is the following. In unfaded channels, if N m > N e , 
the minimum bit energy is infinite and secure communication 
is not possible. On the other hand, in fading channels, the bit 
energy is finite as long as N m is finite and N e > 0. Clearly, 
even if N m > N e , favorable fading conditions enable secure 
transmission in fading channels. 
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